# CEMarque

> Scope, classification and reporting obligations under Regulation (EU) 2024/2847, the EU Cyber Resilience Act. Every answer cites the Article it comes from. Facts Table v2026.09.2, released 2026-09-03.

CEMarque prepares documentation and encodes the Regulation. It does not certify anything, and it is not legal advice. The manufacturer declares conformity.

## Key dates

- Article 14 reporting of actively exploited vulnerabilities and severe incidents applies from 2026-09-11.
- Full application, including CE marking, technical documentation and the EU Declaration of Conformity, from 2027-12-11.
- These are two separate clocks. A product placed on the market before full application is subject to Article 14 reporting now and needs CE marking only on substantial modification.

## Tools

- [Scope checker](https://cemarque.com/check): answers up to nine questions and returns scope, role, class, conformity route and both dates.
- [Facts Table (JSON)](https://cemarque.com/facts/api/v1/facts.json): every fact with its Article citation, plus the Annex III/IV class list and the corpus index.
- [Status of open questions](https://cemarque.com/facts/status): what is settled and what is not, with dates.
- [Pricing](https://cemarque.com/pricing): the checker is free; the documentation products are paid and not yet built.

## Facts pages

- [Does the EU Cyber Resilience Act apply to my mobile app?](https://cemarque.com/facts/applies-to-mobile-apps): Yes, in almost every case. An installed app that connects to anything is a product with digital elements, and publishing it in an EU app store makes it available on the EU market.
- [Does the CRA apply to browser extensions?](https://cemarque.com/facts/browser-extensions): Yes, if it is monetised. An extension is installed software that connects to a network. The class question matters here: browsers are listed as important products, and extensions are not the browser.
- [What must I do by 11 December 2027?](https://cemarque.com/facts/by-11-december-2027): Everything else. From full application a product placed on the EU market needs a completed technical file, an EU declaration of conformity you sign, CE marking, a stated support period and a software bill of materials.
- [What must I do by 11 September 2026?](https://cemarque.com/facts/by-11-september-2026): Be able to report. From that date manufacturers must notify actively exploited vulnerabilities and severe incidents through the ENISA platform, with an early warning within 24 hours of becoming aware.
- [Does the CRA apply to free or ad-supported apps?](https://cemarque.com/facts/free-and-ad-supported-apps): Charging nothing does not put you outside the Regulation. What matters is whether the product is supplied in the course of a commercial activity, and advertising, data and freemium funnels all count.
- [Does the CRA apply to games?](https://cemarque.com/facts/games): Yes for a commercially published game with any online component. The awkward parts for studios are the support period, automatic security updates for consumer products, and games that are already shipped.
- [Does the CRA apply to open-source software I maintain?](https://cemarque.com/facts/open-source): Unmonetised open source is not placed on the market and is outside the Regulation. Stewards who systematically support commercial-use projects have a lighter regime. Companies that integrate your code are manufacturers of their products.
- [What is a product with digital elements under the CRA?](https://cemarque.com/facts/product-with-digital-elements): A software or hardware product and its remote data processing solutions, including components placed on the market separately. The phrase is broad on purpose and the remote-processing half is the part people miss.
- [Is SaaS in scope of the CRA?](https://cemarque.com/facts/saas-in-scope): A pure cloud service is generally outside the CRA and falls under NIS2 instead. But a backend your own installed product cannot function without is part of that product, and is in scope with it.
- [Does the CRA apply to WordPress plugins and themes?](https://cemarque.com/facts/wordpress-plugins-and-themes): A paid or freemium plugin is a product with digital elements and is in scope. A genuinely non-monetised free plugin is not. Agencies that ship client sites under their own name are manufacturers of what they ship.